_xfcc_haproxy.html.md.erb

#### <a id="xfcc_haproxy"></a> Terminating TLS at HAProxy

This option allows you to configure support for the XFCC header while leveraging HAProxy. When selected, HAProxy sets the XFCC header to the contents of the client certificate received in the TLS handshake.

Selecting this configuration requires that the load balancer in front of HAProxy is configured to pass through the TLS handshake to HAProxy via TCP.

This mode is enabled when the <b>TLS terminated for the first time at HAProxy</b> option is selected in the **Networking** configuration screen of the PAS tile.

HAProxy trusts the Diego intermediate certificate authority. This trust is enabled automatically and permits mutual authentication between applications that are running on Pivotal Cloud Foundry.